WHAT IS CLAIMED IS: 

1 . A platform for processing a partitioned network infrastructure application, 
comprising: 

first processing.means- for processing an application processor (AP) 

module; and 

second processing means for processing a policy engine (PE) module, 
wherein the PE module includes a plurality of action and classification engines (ACEs), 
the plurality of ACEs including two or more instances of a particular ACE. 

2. The platform of claim 1 wherein the plurality of ACEs includes instances of two 
or more different ACEs. 

3. The platform of claim 1 further including messaging means for supporting 
communication between the AP module and the PE module. 

4. The platform of claim 1 wherein the plurality of ACEs are processed serially. 

5. The platform of claim 1 wherein at least one of the plurality of ACEs includes a 
user-definable action component. 

6. The platform of claim 5 wherein the user-definable action component is definable 
using a general purpose programming language. 

7. The platform of claim 1 wherein the second processing means is implemented in 
hardware. 

8. The platform of claim 1 wherein the second processing means is implemented in 
software. 
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9. The platform of claim 1 wherein the PE module and the AP module are processed 
on a same physical resource. 

10. The platform of claim 1 wherein at least one of the plurality of ACEs further 
includes a frame classification rule. 

11. The platform of claim 10 wherein the at least one ACE further includes an action 
associated with the frame classification. 

12. The platform of claim 1 wherein at least one of the plurality of ACEs further 
includes a target, the target representing a packet destination for a classified frame. 

13. The platform of claim 1 wherein at least one of the plurality of ACEs further 
includes a plurality of targets, the plurality of targets representing two or more 
destinations for a classified frame. 

14. The platform of claim 1 wherein at least one of the plurality of ACEs further 
includes a context for upcalls between the AP and PE modules. 

15. The platform of claim 1 wherein at least one of the plurality of ACEs further 
includes a context for downcalls between the AP and PE modules. 

16. The platform of claim 1 wherein at least one of the plurality of ACEs performs 
demux operations. 

( 17. The platform of claim 1 wherein at least one of the plurality of ACEs sends a 
frame to a plurality of downstream ACEs. 
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18. An apparatus to process a partitioned network infrastructure application, 
comprising: 

a first facility to process an application processor (AP) module; and 

a second facility to process a policy engine (PE) module, wherein the PE 

module includes a plurality of action and classification engines (ACEs), the plurality of 

ACEs including two or more instances of a particular ACE. 

19. The apparatus of claim 18 wherein the plurality of ACEs includes instances of 
two or more different ACEs. 

20. The apparatus of claim 1 8 further including a messaging facility to support 
communication between the AP module and the PE module. 

wherein the plurality of ACEs are processed serially. 

wherein at least one of the plurality of ACEs includes a 

wherein the user-definable action component is 
programming language. 

wherein the second facility is implemented in 

wherein the second facility is implemented in software. 

wherein the PE module and the AP module are 
processed on a same physical resource. 

27. The apparatus of claim 18 wherein at least one of the plurality of ACEs further 
includes a frame classification rule. 



51 21. The apparatus of claim 1 8 



p; 22. The apparatus of claim 18 

Ifl user-definable action component. 

* 

[}' 23 . The apparatus of claim 22 

SI definable using a general purpose 
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24. The apparatus of claim 1 8 
hardware. 

25. The apparatus of claim 1 8 

26. The apparatus of claim 1 8 
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28. The apparatus of claim 27 wherein the at least one ACE further includes an action 
associated with the frame classification. 

29. The apparatus of claim 18 wherein at least one of the plurality of ACEs further 
includes a target, the target representing a packet destination for a classified frame. 

30. The apparatus of claim 18 wherein at least one of the plurality of ACEs further 
includes a plurality of targets, the plurality of targets representing two or more 
destinations for a classified frame. 

3 1 . The apparatus of claim 1 8 wherein at least one of the plurality of ACEs further 
includes a context for upcalls between the AP and PE modules. 

32. The apparatus of claim 18 wherein at least one of the plurality of ACEs further 
includes a context for downcalls between the AP and PE modules. 

33. The apparatus of claim 1 8 wherein at least one of the plurality of ACEs performs 
demux operations. 

34. The apparatus of claim 18 wherein at least one of the plurality of ACEs sends a 
frame to a plurality of downstream ACEs. 

35. A method of partitioning a network infrastructure application, the method 
comprising: 

providing an application processor (AP) module; and 

providing a policy engine (PE) module, wherein the PE module includes a 

plurality of action and classification engines (ACEs), the plurality of ACEs including two 

or more instances of a particular ACE. 
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36. The method of claim 35 wherein the plurality of ACEs includes instances of two 
or more different ACEs. 

37. The method of claim 35 further including providing a messaging facility to 
support communication between the AP module and the PE module. 

38. The method of claim 35 wherein the plurality of ACEs are processed serially. 

39. The method of claim 35 wherein at least one of the plurality of ACEs includes a 
user-definable action component. 

40. The method of claim 35 wherein the user-definable action component is definable 
using a general purpose programming language. 

41 . The method of claim 35 wherein the providing of the PE module is implemented 
through hardware. 

42. The method of claim 35 wherein the providing of the PE module is implemented 
through software. 

43. The method of claim 35 wherein the PE module and the AP module are processed 
on a same physical resource. 

44. The method of claim 35 wherein at least one of the plurality of ACEs further 
includes a frame classification rule. 

45. The method of claim 44 wherein the at least one ACE further includes an action 
associated with the frame classification. 

46. The method of claim 35 wherein at least one of the plurality of ACEs further 
includes a target, the target representing a packet destination for a classified frame. 
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47. The method of claim 35 wherein at least one of the plurality of ACEs further 
includes a plurality of targets, the plurality of targets representing two or more 
destinations for a classified frame. 

48. The method of claim 35 wherein at least one of the plurality of ACEs further 
includes a context for upcalls between the AP and PE modules. 

49. The method of claim 35 wherein at least one of the plurality of ACEs further 
includes a context for downcalls between the AP and PE modules. 

50. The method of claim 35 wherein at least one of the plurality of ACEs performs 
demux operations. 

51 . The method of claim 35 wherein at least one of the plurality of ACEs sends a 
frame to a plurality of downstream ACEs. 
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